event add
event unsafe_contains
event remove

ftltl : [](add -> (! unsafe_contains U remove))
